1From 1c3b492b2863b4833ec3f9a4df5a827e69c64af8 Mon Sep 17 00:00:00 2001 2From: Quentin Perret <[email protected]> 3Date: Thu, 17 Feb 2022 19:34:27 +0000 4Subject: [PATCH 14/20] ANDROID: kvm: Test that pVM memory is wiped during 5 teardown 6 7In protected KVM mode, we expect the hypervisor to protect guest secrets 8when they are torn down. Add a test checking this property by running a 9minimal guest, and checking that the content of memory has been wiped by 10the hypervisor after teardown. 11 12Note: although some of the pKVM code has already landed upstream, the 13functionality tested here hasn't at the time of writing. Once it does, 14this test should be sent upstream for review to replace this ANDROID 15patch. 16 17(cherry picked from commit a9dc703806031c8535c84c9905979f86dfaec1d3) 18Bug: 218934075 19Signed-off-by: Quentin Perret <[email protected]> 20--- 21 .../selftests/kvm/aarch64/pvm_wipe_mem.c | 174 ++++++++++++++++++ 22 1 file changed, 174 insertions(+) 23 create mode 100644 tools/testing/selftests/kvm/aarch64/pvm_wipe_mem.c 24 25diff --git a/tools/testing/selftests/kvm/aarch64/pvm_wipe_mem.c b/tools/testing/selftests/kvm/aarch64/pvm_wipe_mem.c 26new file mode 100644 27index 000000000000..4af8ca3c4bad 28--- /dev/null 29+++ b/tools/testing/selftests/kvm/aarch64/pvm_wipe_mem.c 30@@ -0,0 +1,174 @@ 31+// SPDX-License-Identifier: GPL-2.0-only 32+/* 33+ * Test checking that memory of protected guests is wiped after teardown. 34+ * 35+ * Copyright (C) 2022, Google LLC. 36+ */ 37+ 38+#define _GNU_SOURCE 39+ 40+#include <err.h> 41+#include <errno.h> 42+#include <fcntl.h> 43+#include <stdio.h> 44+#include <stdint.h> 45+#include <stdlib.h> 46+#include <string.h> 47+#include <unistd.h> 48+ 49+#include <linux/kvm.h> 50+#include <sys/ioctl.h> 51+#include <sys/mman.h> 52+ 53+#include "kselftest.h" 54+ 55+#define KVM_VM_TYPE_ARM_PROTECTED (1UL << 31) 56+ 57+#define REG_X(number) (0x6030000000100000ULL + (number) * 2UL) 58+#define REG_PC 0x6030000000100040ULL 59+ 60+static void set_one_reg(int vcpufd, uint64_t reg_id, uint64_t val) 61+{ 62+ uint64_t reg_data; 63+ struct kvm_one_reg reg; 64+ int ret; 65+ 66+ reg.addr = (__u64) ®_data; 67+ reg_data = val; 68+ reg.id = reg_id; 69+ 70+ ret = ioctl(vcpufd, KVM_SET_ONE_REG, ®); 71+ if (ret < 0) 72+ ksft_exit_fail_msg("Failed to set reg: %d\n", ret); 73+} 74+ 75+static int get_kvm(void) 76+{ 77+ size_t run_size; 78+ int kvm, ret; 79+ 80+ kvm = open("/dev/kvm", O_RDWR | O_CLOEXEC); 81+ if (kvm < 0) 82+ ksft_exit_skip("KVM not supported\n"); 83+ 84+ ret = ioctl(kvm, KVM_GET_API_VERSION, NULL); 85+ if (ret != 12) 86+ ksft_exit_fail_msg("KVM_GET_API_VERSION %d, expected 12", ret); 87+ 88+ run_size = ioctl(kvm, KVM_GET_VCPU_MMAP_SIZE, NULL); 89+ if (run_size < sizeof(struct kvm_run)) 90+ ksft_exit_fail_msg("KVM_GET_VCPU_MMAP_SIZE unexpectedly small\n"); 91+ 92+ return kvm; 93+} 94+ 95+static int create_protected_vm(int kvm) 96+{ 97+ int vmfd = ioctl(kvm, KVM_CREATE_VM, KVM_VM_TYPE_ARM_PROTECTED); 98+ 99+ if (vmfd < 0) 100+ ksft_exit_skip("Protected guests not supported: %d\n", vmfd); 101+ 102+ return vmfd; 103+} 104+ 105+static int create_vcpu(int vmfd, struct kvm_run **run) 106+{ 107+ struct kvm_vcpu_init vcpu_init; 108+ int vcpufd, ret; 109+ 110+ ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, &vcpu_init); 111+ if (ret) 112+ ksft_exit_fail_msg("Failed to set kvm_vcpu_init %d\n", ret); 113+ 114+ vcpufd = ioctl(vmfd, KVM_CREATE_VCPU, (unsigned long)0); 115+ if (vcpufd < 0) 116+ ksft_exit_fail_msg("Failed to create VCPU: %d\n", vcpufd); 117+ 118+ *run = mmap(NULL, sizeof(**run), PROT_READ | PROT_WRITE, MAP_SHARED, vcpufd, 0); 119+ if (!run) 120+ ksft_exit_fail_msg("Failed to mmap vcpu_run struct\n"); 121+ 122+ ret = ioctl(vcpufd, KVM_ARM_VCPU_INIT, &vcpu_init); 123+ if (ret) 124+ ksft_exit_fail_msg("Failed to initialize VCPU %d\n", ret); 125+ 126+ return vcpufd; 127+} 128+ 129+static void teardown(int kvm, int vmfd, int vcpufd, struct kvm_run *run) 130+{ 131+ int ret = munmap(run, sizeof(*run)); 132+ 133+ if (ret) 134+ ksft_exit_fail_msg("Failed to unmap vCPU run: %d\n", ret); 135+ 136+ ret = close(vcpufd); 137+ if (ret) 138+ ksft_exit_fail_msg("Failed to destroy VCPU: %d\n", ret); 139+ 140+ ret = close(vmfd); 141+ if (ret) 142+ ksft_exit_fail_msg("Failed to destroy VM: %d\n", ret); 143+ 144+ ret = close(kvm); 145+ if (ret) 146+ ksft_exit_fail_msg("Failed to close KVM fd: %d\n", ret); 147+} 148+ 149+int main(void) 150+{ 151+ struct kvm_userspace_memory_region region; 152+ long page_size = sysconf(_SC_PAGESIZE); 153+ int ret, kvm, vmfd, vcpufd; 154+ uint32_t guest_code[2]; 155+ struct kvm_run *run; 156+ uint8_t *guest_mem; 157+ size_t run_size; 158+ 159+ kvm = get_kvm(); 160+ vmfd = create_protected_vm(kvm); 161+ vcpufd = create_vcpu(vmfd, &run); 162+ 163+ /* Create a one-page memslot for the guest */ 164+ guest_mem = mmap(NULL, page_size, PROT_READ | PROT_WRITE, 165+ MAP_SHARED | MAP_ANONYMOUS, -1, 0); 166+ if (guest_mem == MAP_FAILED) 167+ ksft_exit_fail_msg("Failed to mmap guest memory\n"); 168+ region = (struct kvm_userspace_memory_region) { 169+ .slot = 0, 170+ .guest_phys_addr = 1UL << 30, 171+ .memory_size = page_size, 172+ .userspace_addr = (uint64_t)guest_mem, 173+ }; 174+ 175+ /* Copy some code in guest memory. */ 176+ guest_code[0] = 0xf9400001; /* 1: ldr x1, [x0] */ 177+ guest_code[1] = 0x17ffffff; /* b 1b */ 178+ memcpy(guest_mem, guest_code, sizeof(guest_code)); 179+ ret = ioctl(vmfd, KVM_SET_USER_MEMORY_REGION, ®ion); 180+ if (ret) 181+ ksft_exit_fail_msg("Failed to set memory region: %d\n", ret); 182+ 183+ /* 184+ * Get the VCPU to run one instruction, to be sure the page containing 185+ * the code has been faulted in. 186+ */ 187+ set_one_reg(vcpufd, REG_PC, region.guest_phys_addr); 188+ set_one_reg(vcpufd, REG_X(0), region.guest_phys_addr + region.memory_size); 189+ ret = ioctl(vcpufd, KVM_RUN, NULL); 190+ if (ret) 191+ ksft_exit_fail_msg("Failed to run vcpu: %d\n", ret); 192+ if (run->exit_reason != KVM_EXIT_MMIO) 193+ ksft_exit_fail_msg("Unexpected KVM exit reason: %u\n", run->exit_reason); 194+ 195+ /* 196+ * Tear the guest down, and check that the donated memory has been 197+ * wiped by the hypervisor. 198+ */ 199+ teardown(kvm, vmfd, vcpufd, run); 200+ if (!memcmp(guest_mem, guest_code, sizeof(guest_code))) 201+ ksft_exit_fail_msg("Protected guest memory has not been poisoned\n"); 202+ 203+ ksft_exit_pass(); 204+} 205-- 2062.42.0.609.gbb76f46606-goog 207 208